Data protection and privacy statement

This data protection and privacy statement is intended for users of the Maaleipä Challenge [“The Challenge”] website and newsletter recipients. It describes how Challenge participants’ personal data is collected and processed as part of running the Challenge, what personal data are collected, for what purposes personal data are used, and how those personal data are protected. The statement also describes data subjects’ rights and how a data subject can use those rights.

The organiser of The Challenge, IHME Helsinki / Pro Arte Foundation Finland, is responsible for ensuring that personal data are processed in compliance with this data protection and privacy statement and with the relevant data protection legislation.

 

1. REGISTER KEEPER

Pro Arte Foundation Finland [“The Foundation”]

Business Identity Code 21485721

 

2.CONTACT INFORMATION IN MATTERS RELATED TO THE REGISTER

Pro Arte Foundation Finland

e-mail: info@ihmehelsinki.fi

address: Kalevankatu 4, 2nd floor, 00100 Helsinki

 

3. NAME OF REGISTER

The Challenge’s website contains the following register: Maaleipä Challenge participants’ register

 

4. DATA CONTENT OF REGISTER

The personal data collected through the challenge entry form will be stored in the participants’ register for possible contact related to the challenge and to inform about the progress of the challenge. Contact details will not be passed on to third parties or stored in other Pro Arte Foundation Finland’s contact registers without the participant’s consent.

The following information about Challenge participants can be stored in the register:

Participant’s contact details (first name, surname, e-mail address and location)

 

5. PURPOSE OF PROCESSING AND LEGAL BASIS FOR PROCESSING PERSONAL DATA

 

  1. Personal data are stored to run the challenge and communicate about its progress. The legal basis for this is the registered person’s consent.
  2. Personal data are stored in order to send out newsletters to subscribers. The legal basis for the processing of personal data is the registered person’s request to be put on the newsletter list and their consent and/or legitimate interest.

 

6. PERSONAL DATA RETENTION PERIOD

As a rule The Foundation processes personal data only for as long as there is a basis for processing it.

  1. Personal data received through The Challenge entry form will not be stored after The Challenge has ended.
  2. Personal data of people on the newsletter subscription distribution list are stored for as long as the newsletter subscriber wants to remain on the newsletter list. Newsletter subscribers can at any time cancel their subscription through a link in the newsletter.

 

7. THE REGISTER’S REGULAR SOURCES OF DATA

  1. Personal data are acquired from the data subject themself when they complete The Challenge entry form.

 

8. REGULAR DISCLOSURE OF INFORMATION

As a rule personal data will not be disclosed to third parties.

 

9. DISCLOSURE OF INFORMATION OUTSIDE OF THE EU OR ETA

Personal data will not be transmitted or disclosed outside the EU or ETA. The personal data processor Gruppo Software may be located outside of the EU.

 

10. THE REGISTER’S PROTECTION PRINCIPLES

The Foundation protects the personal data contained in the register using appropriate technical and organizational measures, which ensure that the processing of personal data complies with all data protection regulations. Unauthorized bodies do not have access to register data. Only the register keeper and people individually designated by the register keeper can gain access to the personal data contained in the register.

Only individually designated individuals have the right to process and maintain the personal data contained in the register. Everyone who is given the right to access the data also undertakes to comply with the duty of confidentiality.

The information systems and computer equipment maintained using information technology in which the register is located are protected by the customary technical safeguards, such as firewalls and user-specific passwords. The computer equipment is kept in locked premises. Manual material is stored in a separate archive in locked premises that can only be accessed by workers with the right to process personal data.

 

11. REGISTERED DATA SUBJECT’S RIGHTS

Pro Arte Foundation Finland undertakes to implement, either on its own initiative or at the request of the data subject listed in the register and without undue delay, the data subject’s rights as described below. If a request for information affecting the registered person’s rights is not approved, the data subject will be given a reasoned notification stating why the request has not been approved.

11.1. RIGHT OF INSPECTION

The data subject has the right to know what data concerning them is stored in the personal register or that the register does not contain data concerning them.

The data subject should submit an inspection request in a document containing their handwritten signature or verified by some other corresponding method. The request is to be addressed to the register’s contact information address. Inspection requests are free of charge when made at most once a year (12 months).

11.2. RIGHT TO REQUIRE RECTIFICATION OF DATA

If the data subject notices that there is inaccurate or erroneous personal data in the register, the data subject has the right to require such data to be rectified.

Data rectification requests should be made in writing and include enough individual detail to allow implementation of the request: at a minimum the request should give the data subject’s name, details of the inaccurate or erroneous personal data and the completed or corrected data.

The request should be submitted in a document with a handwritten signature or verified by some other corresponding method. The request is to be addressed to the register’s contact information address.

11.3. RIGHT TO REQUIRE RESTRICTION OF PROCESSING OR ERASURE OF DATA

The data subject’s right to require restriction of processing or erasure of data is not an absolute right and only applies in certain circumstances. The data subject has a right to require restriction of the processing of their personal data, for example, in a situation in which the data subject is waiting for the register keeper’s answer to a request to restrict or delete their data.

The data subject has a right to require the register keeper to erase their personal information, for example, if

  1. the personal data are no longer needed for the purpose for which they were collected or for which they were processed or
  2. the data subject withdraws their consent on which the processing is based and there is no other legal basis for processing their personal data.

Requests to restrict processing of or to erase data are to be addressed to the register’s contact information address.

11.4. RIGHT TO WITHDRAW CONSENT

When personal data are processed on the basis of the data subject’s consent (for example, for direct marketing), the data subject has the right to withdraw their consent. Withdrawal of consent has to be made as easy as giving consent. Requests to withdraw consent are to be addressed to the register’s contact information address.

11.5. RIGHT TO OBJECT TO PROCESSING OF DATA

The data subject has the right to object to the processing of their personal data if the data subject, for example, considers that the register keeper has processed their personal data illegally or that the register keeper has no right to process some of their personal data.

11.6. RIGHT TO COMPLAIN TO THE DATA PROTECTION OMBUDSMAN

The data subject has the right to complain to the data protection ombudsman if they think the register keeper has not adhered to the relevant data protection regulations.

 

12. CHANGES TO THE DATA PROTECTION AND PRIVACY STATEMENT

Pro Arte Foundation Finland reserves the right to make changes to this data protection and privacy statement in order to comply with its legal responsibilities. Changes can be necessary, for example, because of a change in the relevant laws or of changes in The Foundation’s operations.